CVE-2025-21842 (GCVE-0-2025-21842)

Vulnerability from cvelistv5 – Published: 2025-03-07 09:10 – Updated: 2026-08-05 11:54
VLAI
Title
amdkfd: properly free gang_ctx_bo when failed to init user queue
Summary
In the Linux kernel, the following vulnerability has been resolved: amdkfd: properly free gang_ctx_bo when failed to init user queue The destructor of a gtt bo is declared as void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj); Which takes void** as the second parameter. GCC allows passing void* to the function because void* can be implicitly casted to any other types, so it can pass compiling. However, passing this void* parameter into the function's execution process(which expects void** and dereferencing void**) will result in errors.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fb91065851cd5f2735348c5f3eddeeca3d7c2973 , < ae5ab1c1ae504f622cc1ff48830a9ed48428146d (git)
Affected: fb91065851cd5f2735348c5f3eddeeca3d7c2973 , < 091a68c58c1bbd2ab7d05d1b32c1306394ec691d (git)
Affected: fb91065851cd5f2735348c5f3eddeeca3d7c2973 , < a33f7f9660705fb2ecf3467b2c48965564f392ce (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.16 , ≤ 6.12.* (semver)
Unaffected: 6.13.4 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae5ab1c1ae504f622cc1ff48830a9ed48428146d",
              "status": "affected",
              "version": "fb91065851cd5f2735348c5f3eddeeca3d7c2973",
              "versionType": "git"
            },
            {
              "lessThan": "091a68c58c1bbd2ab7d05d1b32c1306394ec691d",
              "status": "affected",
              "version": "fb91065851cd5f2735348c5f3eddeeca3d7c2973",
              "versionType": "git"
            },
            {
              "lessThan": "a33f7f9660705fb2ecf3467b2c48965564f392ce",
              "status": "affected",
              "version": "fb91065851cd5f2735348c5f3eddeeca3d7c2973",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\namdkfd: properly free gang_ctx_bo when failed to init user queue\n\nThe destructor of a gtt bo is declared as\nvoid amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj);\nWhich takes void** as the second parameter.\n\nGCC allows passing void* to the function because void* can be implicitly\ncasted to any other types, so it can pass compiling.\n\nHowever, passing this void* parameter into the function\u0027s\nexecution process(which expects void** and dereferencing void**)\nwill result in errors."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the AMDKFD_IOC_CREATE_QUEUE ioctl on the local /dev/kfd character device; there is no network vector.\nAC:L - The attacker controls the trigger \u2014 supplying a wptr buffer allocated on a different GPU deterministically hits the device-mismatch error path on multi-GPU systems, or GART/pin exhaustion forces the map failure; no uncontrollable condition is required.\nPR:L - The create-queue ioctl carries flags=0 with no capability check, so any unprivileged local user with render-group access to /dev/kfd (typical on desktops/workstations) can reach it.\nUI:N - Exploitation is a direct ioctl sequence from the attacker\u0027s own process with no victim action required.\nS:U - The invalid dereference and any resulting corruption occur within the kernel\u0027s own security authority; no privilege/isolation boundary such as a VM or IOMMU domain is crossed.\nC:H - This pointer-vs-pointer-to-pointer type confusion dereferences a fixed userspace-mappable address (0x200000002); on non-SMAP/PAN or nosmap systems the attacker can back that address with a crafted fake amdgpu_bo, yielding attacker-controlled kernel reads.\nI:H - The same crafted-object primitive feeds amdgpu_bo unpin/unref, which perform refcount decrements and destructor dispatch on the attacker-controlled structure, enabling kernel memory corruption and potential control-flow hijack.\nA:H - On the common case (SMAP enabled) the wild dereference of 0x200000002 faults immediately, producing a kernel oops/panic and denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:51.838Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae5ab1c1ae504f622cc1ff48830a9ed48428146d"
        },
        {
          "url": "https://git.kernel.org/stable/c/091a68c58c1bbd2ab7d05d1b32c1306394ec691d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a33f7f9660705fb2ecf3467b2c48965564f392ce"
        }
      ],
      "title": "amdkfd: properly free gang_ctx_bo when failed to init user queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21842",
    "datePublished": "2025-03-07T09:10:00.298Z",
    "dateReserved": "2024-12-29T08:45:45.777Z",
    "dateUpdated": "2026-08-05T11:54:51.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21842",
      "date": "2026-09-29",
      "epss": "0.00237",
      "percentile": "0.13203"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ae5ab1c1ae504f622cc1ff48830a9ed48428146d",
                    "status": "affected",
                    "version": "fb91065851cd5f2735348c5f3eddeeca3d7c2973",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "091a68c58c1bbd2ab7d05d1b32c1306394ec691d",
                    "status": "affected",
                    "version": "fb91065851cd5f2735348c5f3eddeeca3d7c2973",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a33f7f9660705fb2ecf3467b2c48965564f392ce",
                    "status": "affected",
                    "version": "fb91065851cd5f2735348c5f3eddeeca3d7c2973",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "537F3B42-2EC5-47FB-8166-5ACF0353AFEC",
                    "versionEndExcluding": "6.12.16",
                    "versionStartIncluding": "6.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2A2093ED-74A9-43F9-AC72-50030F374EA4",
                    "versionEndExcluding": "6.13.4",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\namdkfd: properly free gang_ctx_bo when failed to init user queue\n\nThe destructor of a gtt bo is declared as\nvoid amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj);\nWhich takes void** as the second parameter.\n\nGCC allows passing void* to the function because void* can be implicitly\ncasted to any other types, so it can pass compiling.\n\nHowever, passing this void* parameter into the function\u0027s\nexecution process(which expects void** and dereferencing void**)\nwill result in errors."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: amdkfd: libera correctamente gang_ctx_bo cuando no se puede inicializar la cola de usuarios El destructor de un bo gtt se declara como void amdgpu_amdkfd_free_gtt_mem(struct amdgpu_device *adev, void **mem_obj); que toma void** como segundo par\u00e1metro. GCC permite pasar void* a la funci\u00f3n porque void* se puede convertir impl\u00edcitamente a cualquier otro tipo, por lo que puede pasar la compilaci\u00f3n. Sin embargo, pasar este par\u00e1metro void* al proceso de ejecuci\u00f3n de la funci\u00f3n (que espera void** y desreferenciar void**) dar\u00e1 como resultado errores."
          }
        ],
        "id": "CVE-2025-21842",
        "lastModified": "2026-07-30T06:21:40.627",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-03-07T09:15:17.237",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/091a68c58c1bbd2ab7d05d1b32c1306394ec691d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a33f7f9660705fb2ecf3467b2c48965564f392ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ae5ab1c1ae504f622cc1ff48830a9ed48428146d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:13:18+00:00",
      "cve": "CVE-2025-21842",
      "id": "CVE-2025-21842",
      "initial_release_date": "2025-03-07T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: amdkfd: properly free gang_ctx_bo when failed to init user queue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21842.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-23T00:47:29Z",
      "cve": "CVE-2025-21842",
      "id": "CVE-2025-21842",
      "initial_release_date": "2025-03-08T02:50:23Z",
      "product_status:known_affected": "461",
      "product_status:known_not_affected": "402",
      "product_status:recommended": "171",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21842",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21842.json",
      "version": "27"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.